Hardware Cryptography and z/tpf

Transcription

1 z/tpf V TPF Users Group Hardware Cryptography and z/tpf Mark Gambino Communications Subcommittee AIM Enterprise Platform Software IBM z/transaction Processing Facility Enterprise Edition 1.1 Any reference to future plans are for planning purposes only. IBM reserves the right to change those plans at its discretion. Any reliance on such a disclosure is solely at your own risk. IBM makes no commitment to provide additional information in the future.

2 Overview of Current Support on z/tpf

3 Types of Hardware Cryptography on System z Central Processor Assist for Cryptographic Functions (CPACF) Coprocessor integrated into the multi-chip module (MCM) Each CPACF is shared by 2 cores Crypto Express Physical cards that you plug into the processor 1 feature = 1 physical card 1 Crypto Express3 feature = 2 Crypto Express3 adapters Each adapter operates independently 1 Crypto Express4S feature = 1 Crypto Express4S adapter zec12 supports Crypto Express3 and Crypto Express4S

4 Basic z/tpf Crypto Support Clear key APIs Encrypt/decrypt data using DES, TDES, AES-128, or AES-256 Uses CPACF if the algorithm is supported by CPACF on the processor; otherwise, software is used Key management is user responsibility Digest APIs Create/verify digest of data using SHA-1 or SHA-256 Requires that the CPACF on the processor supports the algorithm

5 Secure Symmetric Key Management Support Enables you to create and manage symmetric encryption keys in a secure manner DES, TDES, AES-128, and AES-256 Requires that the CPACF on the processor supports the algorithm APIs to enable applications to protect sensitive data High performance designed for mainline application use Access controls to limit and log key usage Can help you meet the ever growing list of security and compliance standards

6 z/tpf Symmetric Key Cryptography and Digest APIs Middleware Application z/tpf Symmetric Key Keystore Secure Key API Handler Clear Key API Handler Digest API Handler CPACF

7 z/tpf Public Key Infrastructure (PKI) Support Create and manage RSA public key pairs in a secure manner on z/tpf Use the RSA keys generated on z/tpf to create digital certificate requests as well as self-signed digital certificates Enable z/tpf SSL applications and middleware to use private keys generated by z/tpf APIs to encrypt and decrypt user data using RSA APIs to create and verify RSA digital signatures

8 Crypto Express Accelerators Crypto Express adapters can be configured to run in different modes An adapter runs in only one mode at a time Crypto Express adapter running in accelerator mode performs RSA operations at a high rate Up to a few thousands operations per second depending on the operation type and key size Required to use z/tpf PKI support Recommended to use SSL support

9 z/tpf Public Key Cryptography Middleware Application z/tpf Public Key Keystore RSA API Handler Digital Signature API Handler Digest API Handler Crypto Express Accelerator CPACF

10 Crypto Express Coprocessor

11 Crypto Express Coprocessor Crypto Express adapters can also configured to run coprocessor mode Supported by z/os and Linux on z Not currently supported by z/tpf IBM Common Cryptographic Architecture (CCA) APIs support many algorithms, including banking cryptography functions Customer loads master keys into the adapter using a secure trusted key entry (TKE) interface Secure, tamper-resistant card FIPS level 4 certification A user key needs to be encrypted under the master key to become an operational key

12 Using Another LPAR to Access Crypto Express Coprocessor If you have z/os or Linux LPARs, today you could use those LPARs to access Crypto Express coprocessors How to do this: 1. Update your z/tpf application to send a message over TCP/IP to the other LPAR Message contains the name of the CCA API along with all the input parameters to that API 2. Write a server program on the other LPAR that receives the message from z/tpf over TCP/IP, issues the appropriate CCA API, then passes the output of that API back to the z/tpf application over TCP/IP

13 Using Another LPAR to Access Crypto Express Coprocessor z/os or Linux Application User Crypto Server Application z/tpf TCP/IP Stack TCP/IP Stack CCA Crypto Library OSA Express Crypto Express Coprocessor

14 Using Another LPAR to Access Crypto Express Coprocessor High Availability Configuration z/tpf z/os or Linux z/os or Linux Application User Crypto Server Application User Crypto Server Application TCP/IP Stack TCP/IP Stack CCA Crypto Library TCP/IP Stack CCA Crypto Library OSA Express OSA Express Crypto Express Coprocessor Crypto Express Coprocessor

15 Any Interest in z/tpf Supporting Crypto Express Coprocessor Directly? Port portions of the CCA library from Linux to z/tpf Need to know which APIs you want z/tpf to support defines the APIs available on Linux for System z These APIs are also implemented by the Integrated Cryptographic Service Facility (ICSF) on z/os Also need to know what options on each API you plan to use For example, some APIs have dozens of different options Need to know what key management APIs you would need Creating keys, importing keys, changing master keys Would need a z/os or Linux LPAR on the processor where the Crypto Express coprocessor resides to load or change master keys on that adapter

16 z/tpf with Some Crypto Express Coprocessor Support: Loading Master Keys z/tpf Application CCA Crypto Library z/os or Linux TKE and CCA Crypto Libraries TKE Workstation Crypto Express Coprocessor

17 z/tpf with Some Crypto Express Coprocessor Support: Applications Issuing Crypto APIs z/tpf Application CCA APIs CCA Crypto Library Crypto Express Coprocessor

18 Options for Crypto Express Coprocessor Use by z/tpf 1. Do nothing no interest in Crypto Express coprocessor 2. Customer written code to access Crypto Express coprocessor on another (z/os or Linux) LPAR IBM could provide client communications layer to do server selection, load balancing, and exchange messages with the selected server This code could be general purpose for exchanging any type of user message between a z/tpf client and one of many servers 3. z/tpf supports a limited subset of the CCA APIs to access Crypto Express coprocessor directly

19 Trademarks IBM, the IBM logo, and ibm.com are trademarks or registered trademarks of International Business Machines Corp., registered in many jurisdictions worldwide. Other product and service names might be trademarks of IBM or other companies. A current list of IBM trademarks is available on the Web at Copyright and trademark information at (Include any special attribution statements as required see Trademark guidelines on IBM%20Tr) Notes Performance is in Internal Throughput Rate (ITR) ratio based on measurements and projections using standard IBM benchmarks in a controlled environment. The actual throughput that any user will experience will vary depending upon considerations such as the amount of multiprogramming in the user's job stream, the I/O configuration, the storage configuration, and the workload processed. Therefore, no assurance can be given that an individual user will achieve throughput improvements equivalent to the performance ratios stated here. All customer examples cited or described in this presentation are presented as illustrations of the manner in which some customers have used IBM products and the results they may have achieved. Actual environmental costs and performance characteristics will vary depending on individual customer configurations and conditions. This publication was produced in the United States. IBM may not offer the products, services or features discussed in this document in other countries, and the information may be subject to change without notice. Consult your local IBM business contact for information on the product or services available in your area. All statements regarding IBM's future direction and intent are subject to change or withdrawal without notice, and represent goals and objectives only. Information about non-ibm products is obtained from the manufacturers of those products or their published announcements. IBM has not tested those products and cannot confirm the performance, compatibility, or any other claims related to non-ibm products. Questions on the capabilities of non-ibm products should be addressed to the suppliers of those products. Prices subject to change without notice. Contact your IBM representative or Business Partner for the most current pricing in your geography. This presentation and the claims outlined in it were reviewed for compliance with US law. Adaptations of these claims for use in other geographies must be reviewed by the local country counsel for compliance with local laws.